Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I found this on the internet, while putting up a FTP server in FreeBSD.

Putting nologin into /etc/shells potentially creates a back door by which those accounts can be used with FTP.

(see: http://osdir.com/ml/freebsd-questions/2005-12/msg02392.html)

Can anybody explain why this is? And why taking a copy of the nologin and putting that one in the /etc/shells resolves this problem?

share|improve this question

2 Answers 2

up vote 18 down vote accepted

/etc/shells contains a list of binaries that the system considers (unrestricted) shells. That means that any use that has configured one of those binaries as their shell is assumed to have full access to the system (meaning they can execute any command, provided they have the appropriate permission).

The most direct result is that they can use chsh to change their configured shell.

If a user has a shell configured that's not in this list, then they system assumes that he's somehow restricted. In the case of chsh it means that the user can't change that value.

Other programs might query that list and apply similar restrictions.

So by putting nologin in /etc/shells you effectively say "any user that has nologin as its shell is considered a full, unrestricted user". That's almost certainly the exact opposite of what nologin was meant to say.

share|improve this answer

ftp doesn't provide a standard shell, it provides an ftp interface. Users that have an account even though their shell points to nologin can still access the ftp interface. In addition they'll still be able to access any other services you provide that don't require a shell as well (for example, if you have a http web interface, etc. that relies on account authentication but not shell access). This isn't necessarily a back door onto your system, but is a back door into services.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.